Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Warning: Not sure if this question is a good fit for this SE, but I need serious advice that I can get no where else

Over the weekend, massive number of files and folders were deleted from our DFS. I cannot find anyway to trace whether it was a program or someone who deleted them. There a a few things I observe:

  1. In root namespace, out of the folders that survived the mass delete, all had contents intact except for the first sub-folder ordered by name, which only has partial files intact. - this leads me to think files were deleted at the root folders in named sequence.
  2. In root namespace, all of the folders has partial content deleted. - this leads me to think that root folders were deleted in parallel.

Does a normal select all folders and delete generate this kind of deleting sequence? Is there anyway to trace who or what deleted it? I checked the auditing event logs but cannot find anything about deleting files and folders.

share|improve this question

migrated from superuser.com Sep 29 '12 at 22:06

This question came from our site for computer enthusiasts and power users.

add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.